open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-20 08:05:22 +08:00
Code Issues Packages Projects Releases Wiki Activity
Files
c699c32461bee57eb7b0c80a01df8ea049159bf4
qinglong/.github/workflows/ql3-image-release.yml
T

533 lines
22 KiB
YAML
Raw Blame History

name: 'QingLong 3.0 Image Release'
on:
workflow_dispatch:
inputs:
version:
description: Exact QingLong 3 SemVer tag without the v prefix
required: true
type: string
permissions:
contents: read
concurrency:
group: ql3-image-release-${{ github.ref }}
cancel-in-progress: false
jobs:
worker-management-release-evidence:
name: Audit private Worker management release evidence
runs-on: [self-hosted, linux, ql3-release-evidence-ephemeral]
environment: ql3-production-release-evidence
timeout-minutes: 10
permissions:
contents: read
steps:
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
with:
persist-credentials: false
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
with:
node-version: '24.18.0'
- name: Re-audit commit-scoped private production evidence
env:
RELEASE_VERSION: ${{ inputs.version }}
run: |
set -euo pipefail
umask 077
if [[ ! "${GITHUB_SHA}" =~ ^[0-9a-f]{40,64}$ ]]; then
echo "release source commit is malformed" >&2
exit 1
fi
if [[ ! "${RELEASE_VERSION}" =~ ^3\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?$ ]]; then
echo "release version must be QingLong 3 SemVer" >&2
exit 1
fi
if [[ "${GITHUB_REF_TYPE}" != "tag" || "${GITHUB_REF_NAME}" != "v${RELEASE_VERSION}" ]]; then
echo "workflow dispatch must target the exact protected release tag" >&2
exit 1
fi
evidence_dir="/run/qinglong3-release-evidence/${GITHUB_SHA}"
node scripts/ql3-worker-credential-management-release-gate.cjs \
--report="${evidence_dir}/worker-management-release-evidence.json" \
--ceremony-report="${evidence_dir}/worker-management-ceremony.json" \
--durable-audit-report="${evidence_dir}/worker-management-durable-audit.json" \
--pki-rotation-report="${evidence_dir}/worker-management-pki-rotation-v2.json" \
--ca-rollover-report="${evidence_dir}/worker-management-ca-rollover.json" \
--source-commit="${GITHUB_SHA}" \
--release-version="${RELEASE_VERSION}"
cluster-dr-release-evidence:
name: Audit private CloudNativePG disaster-recovery evidence
runs-on: [self-hosted, linux, ql3-release-evidence-ephemeral]
environment: ql3-production-release-evidence
timeout-minutes: 10
permissions:
contents: read
steps:
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
with:
persist-credentials: false
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
with:
node-version: '24.18.0'
- name: Re-audit commit-scoped private disaster-recovery evidence
env:
RELEASE_VERSION: ${{ inputs.version }}
run: |
set -euo pipefail
umask 077
if [[ ! "${GITHUB_SHA}" =~ ^[0-9a-f]{40,64}$ ]]; then
echo "release source commit is malformed" >&2
exit 1
fi
if [[ ! "${RELEASE_VERSION}" =~ ^3\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?$ ]]; then
echo "release version must be QingLong 3 SemVer" >&2
exit 1
fi
if [[ "${GITHUB_REF_TYPE}" != "tag" || "${GITHUB_REF_NAME}" != "v${RELEASE_VERSION}" ]]; then
echo "workflow dispatch must target the exact protected release tag" >&2
exit 1
fi
evidence_dir="/run/qinglong3-release-evidence/${GITHUB_SHA}"
report="${evidence_dir}/cloudnativepg-dr-evidence.json"
node scripts/ql3-cloudnativepg-backup-audit.cjs
node scripts/ql3-barman-cloud-supply-chain-audit.cjs
node scripts/ql3-cert-manager-selection-audit.cjs
node scripts/ql3-cloudnativepg-dr-release-gate.cjs \
--report="${report}" \
--source-commit="${GITHUB_SHA}" \
--release-version="${RELEASE_VERSION}"
os-vulnerability:
name: Scan ${{ matrix.image }} OS packages on ${{ matrix.image_arch }}
runs-on: ${{ matrix.runner }}
timeout-minutes: 45
permissions:
contents: read
strategy:
fail-fast: false
matrix:
include:
- image: control
runner: ubuntu-24.04
node_arch: x64
image_arch: amd64
dockerfile: deploy/containers/ql3-cluster-control/Dockerfile
target: runtime
- image: control
runner: ubuntu-24.04-arm
node_arch: arm64
image_arch: arm64
dockerfile: deploy/containers/ql3-cluster-control/Dockerfile
target: runtime
- image: control-ai
runner: ubuntu-24.04
node_arch: x64
image_arch: amd64
dockerfile: deploy/containers/ql3-cluster-control/Dockerfile
target: runtime-ai
- image: control-ai
runner: ubuntu-24.04-arm
node_arch: arm64
image_arch: arm64
dockerfile: deploy/containers/ql3-cluster-control/Dockerfile
target: runtime-ai
- image: admin
runner: ubuntu-24.04
node_arch: x64
image_arch: amd64
dockerfile: deploy/containers/ql3-cluster-admin/Dockerfile
target: runtime
- image: admin
runner: ubuntu-24.04-arm
node_arch: arm64
image_arch: arm64
dockerfile: deploy/containers/ql3-cluster-admin/Dockerfile
target: runtime
- image: local
runner: ubuntu-24.04
node_arch: x64
image_arch: amd64
dockerfile: deploy/containers/ql3-local-application/Dockerfile
target: runtime
- image: local
runner: ubuntu-24.04-arm
node_arch: arm64
image_arch: arm64
dockerfile: deploy/containers/ql3-local-application/Dockerfile
target: runtime
steps:
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
with:
persist-credentials: false
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
with:
node-version: '24.18.0'
- uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
- name: Verify native scanner architecture
run: node -e "if (process.arch !== '${{ matrix.node_arch }}') throw new Error('unexpected architecture ' + process.arch)"
- name: Audit the bounded exception lifecycle
run: node scripts/ql3-image-os-vulnerability-policy.cjs
- name: Build the exact native OCI release artifact once
run: |
set -euo pipefail
mkdir -p "${RUNNER_TEMP}/ql3-native"
docker buildx build \
--platform linux/${{ matrix.image_arch }} \
--file ${{ matrix.dockerfile }} \
--target ${{ matrix.target }} \
--build-arg SOURCE_REVISION=${{ github.sha }} \
--attest type=provenance,mode=max \
--attest type=sbom \
--output "type=oci,dest=${RUNNER_TEMP}/ql3-native/image.oci.tar" \
.
- name: Materialize image-scoped Trivy exceptions
run: >-
node scripts/ql3-image-os-vulnerability-policy.cjs
--image=${{ matrix.image }}
--output=${{ runner.temp }}/ql3-${{ matrix.image }}-${{ matrix.image_arch }}.trivyignore.yaml
- name: Reject unexcepted high or critical OS vulnerabilities
uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
with:
version: 'v0.70.0'
input: ${{ runner.temp }}/ql3-native/image.oci.tar
scanners: 'vuln'
vuln-type: 'os'
severity: 'HIGH,CRITICAL'
ignore-unfixed: 'false'
exit-code: '1'
format: 'table'
hide-progress: 'true'
timeout: '10m0s'
cache: 'false'
trivyignores: ${{ runner.temp }}/ql3-${{ matrix.image }}-${{ matrix.image_arch }}.trivyignore.yaml
- name: Bind the successful native scan to the OCI digest
run: |
set -euo pipefail
mkdir "${RUNNER_TEMP}/ql3-native/layout"
tar -xf "${RUNNER_TEMP}/ql3-native/image.oci.tar" \
-C "${RUNNER_TEMP}/ql3-native/layout"
node scripts/ql3-image-release-bundle.cjs \
--mode=record-native \
--image=${{ matrix.image }} \
--platform=linux/${{ matrix.image_arch }} \
--layout=${{ runner.temp }}/ql3-native/layout \
--expected-revision=${{ github.sha }} \
--evidence=${{ runner.temp }}/ql3-native/evidence.json
rm "${RUNNER_TEMP}/ql3-native/image.oci.tar"
- name: Upload the scanned immutable native OCI artifact
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: ql3-release-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.image }}-${{ matrix.image_arch }}
path: ${{ runner.temp }}/ql3-native
if-no-files-found: error
retention-days: 1
compression-level: 0
overwrite: false
include-hidden-files: false
publish:
name: Publish immutable multi-architecture ${{ matrix.image }} image
needs:
- worker-management-release-evidence
- cluster-dr-release-evidence
- os-vulnerability
runs-on: ubuntu-24.04
permissions:
contents: read
packages: write
id-token: write
attestations: write
artifact-metadata: write
strategy:
fail-fast: false
matrix:
include:
- image: control
repository: qinglong3-cluster-control
runtime_root: deploy/containers/ql3-cluster-control/runtime-dependencies
- image: control-ai
repository: qinglong3-cluster-control-ai
runtime_root: deploy/containers/ql3-cluster-control/runtime-dependencies
- image: admin
repository: qinglong3-cluster-admin
runtime_root: deploy/containers/ql3-cluster-admin/runtime-dependencies
- image: local
repository: qinglong3-local-application
runtime_root: deploy/containers/ql3-local-application/runtime-dependencies
steps:
- uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
with:
persist-credentials: false
- uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
with:
node-version: '24.18.0'
- name: Resolve and validate release identity
id: identity
env:
DISPATCH_VERSION: ${{ inputs.version }}
IMAGE_REPOSITORY: ${{ matrix.repository }}
run: |
set -euo pipefail
owner="${GITHUB_REPOSITORY_OWNER,,}"
image="ghcr.io/${owner}/${IMAGE_REPOSITORY}"
version="${DISPATCH_VERSION}"
if [[ ! "${version}" =~ ^3\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-[0-9A-Za-z]+([.-][0-9A-Za-z]+)*)?$ ]]; then
echo "release version must be QingLong 3 SemVer" >&2
exit 1
fi
if [[ "${GITHUB_REF_TYPE}" != "tag" || "${GITHUB_REF_NAME}" != "v${version}" ]]; then
echo "release source must be the exact requested tag" >&2
exit 1
fi
echo "image=${image}" >> "${GITHUB_OUTPUT}"
echo "version=${version}" >> "${GITHUB_OUTPUT}"
- name: Generate and audit the reviewed application SBOM
run: >-
node scripts/ql3-cluster-image-sbom.cjs
--image=${{ matrix.image }}
--output=${{ runner.temp }}/${{ matrix.repository }}.cdx.json
- name: Reject high or critical production dependency advisories
run: >-
npm audit
--omit=dev
--audit-level=high
--prefix=${{ matrix.runtime_root }}
- name: Download the exact scanned amd64 OCI artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: ql3-release-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.image }}-amd64
path: ${{ runner.temp }}/native/amd64
- name: Download the exact scanned arm64 OCI artifact
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with:
name: ql3-release-${{ github.run_id }}-${{ github.run_attempt }}-${{ matrix.image }}-arm64
path: ${{ runner.temp }}/native/arm64
- name: Merge and re-audit the scanned OCI digest without rebuilding
id: bundle
run: |
set -euo pipefail
node scripts/ql3-image-release-bundle.cjs \
--mode=merge \
--image=${{ matrix.image }} \
--amd64-layout=${RUNNER_TEMP}/native/amd64/layout \
--amd64-evidence=${RUNNER_TEMP}/native/amd64/evidence.json \
--arm64-layout=${RUNNER_TEMP}/native/arm64/layout \
--arm64-evidence=${RUNNER_TEMP}/native/arm64/evidence.json \
--expected-revision=${GITHUB_SHA} \
--output=${RUNNER_TEMP}/${{ matrix.repository }}-release-layout \
--predicate=${RUNNER_TEMP}/${{ matrix.repository }}-os-vulnerability.json \
--report=${RUNNER_TEMP}/${{ matrix.repository }}-bundle.json
digest="$(node -e 'const fs=require("node:fs");const value=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));if(!/^sha256:[0-9a-f]{64}$/.test(value.rootIndexDigest))process.exit(1);process.stdout.write(value.rootIndexDigest)' "${RUNNER_TEMP}/${{ matrix.repository }}-bundle.json")"
echo "digest=${digest}" >> "${GITHUB_OUTPUT}"
tar -C "${RUNNER_TEMP}/${{ matrix.repository }}-release-layout" \
-cf "${RUNNER_TEMP}/${{ matrix.repository }}-release.oci.tar" .
- name: Install the exact checksum-pinned OCI copier
env:
REGCTL: ${{ runner.temp }}/regctl
run: |
set -euo pipefail
curl --fail --location --proto '=https' --tlsv1.2 \
--output "${REGCTL}" \
https://github.com/regclient/regclient/releases/download/v0.11.5/regctl-linux-amd64
echo "c93aa7638749f5aaac1a8e01787321889c78f0101809bb2880343478d0ba0467 ${REGCTL}" | sha256sum --check --strict
chmod 0755 "${REGCTL}"
"${REGCTL}" version
- uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Import the scanned OCI graph by digest without a public tag
id: push
env:
IMAGE: ${{ steps.identity.outputs.image }}
DIGEST: ${{ steps.bundle.outputs.digest }}
ARCHIVE: ${{ runner.temp }}/${{ matrix.repository }}-release.oci.tar
REGCTL: ${{ runner.temp }}/regctl
run: |
set -euo pipefail
if [[ ! "${DIGEST}" =~ ^sha256:[0-9a-f]{64}$ ]]; then
echo "bundle did not return an immutable SHA-256 digest" >&2
exit 1
fi
"${REGCTL}" image import "${IMAGE}@${DIGEST}" "${ARCHIVE}"
remote_digest="$("${REGCTL}" image digest "${IMAGE}@${DIGEST}")"
if [[ "${remote_digest}" != "${DIGEST}" ]]; then
echo "registry changed the scanned OCI digest" >&2
exit 1
fi
echo "digest=${DIGEST}" >> "${GITHUB_OUTPUT}"
- uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
- name: Keylessly sign the immutable manifest digest
env:
IMAGE: ${{ steps.identity.outputs.image }}
DIGEST: ${{ steps.push.outputs.digest }}
run: cosign sign --yes "${IMAGE}@${DIGEST}"
- name: Attest SLSA build provenance
uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4
with:
subject-name: ${{ steps.identity.outputs.image }}
subject-digest: ${{ steps.push.outputs.digest }}
push-to-registry: true
- name: Attest the reviewed CycloneDX application SBOM
uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4
with:
subject-name: ${{ steps.identity.outputs.image }}
subject-digest: ${{ steps.push.outputs.digest }}
sbom-path: ${{ runner.temp }}/${{ matrix.repository }}.cdx.json
push-to-registry: true
- name: Attest the digest-bound OS vulnerability evidence
uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4
with:
subject-name: ${{ steps.identity.outputs.image }}
subject-digest: ${{ steps.push.outputs.digest }}
predicate-type: https://qinglong.dev/attestations/image-os-vulnerability/v1
predicate-path: ${{ runner.temp }}/${{ matrix.repository }}-os-vulnerability.json
push-to-registry: true
- name: Verify the published manifest and attestation bindings
env:
IMAGE: ${{ steps.identity.outputs.image }}
DIGEST: ${{ steps.push.outputs.digest }}
run: |
set -euo pipefail
manifest="${RUNNER_TEMP}/${{ matrix.repository }}-index.json"
docker buildx imagetools inspect --raw "${IMAGE}@${DIGEST}" > "${manifest}"
node scripts/ql3-cluster-remote-manifest-audit.cjs \
--manifest="${manifest}" \
--expected-image="${IMAGE}" \
--expected-digest="${DIGEST}"
- name: Verify local rollout compatibility against the pushed digest
if: matrix.image == 'local'
env:
IMAGE: ${{ steps.identity.outputs.image }}
DIGEST: ${{ steps.push.outputs.digest }}
run: |
set -euo pipefail
corepack enable
pnpm install --frozen-lockfile --ignore-scripts
pnpm --filter @qinglong/local-owner-cli check
docker pull "${IMAGE}@${DIGEST}"
docker_executable="$(realpath "$(command -v docker)")"
docker_socket="$(realpath /var/run/docker.sock)"
node scripts/ql3-local-compose-rollout-live-contract.cjs \
--image="${IMAGE}@${DIGEST}" \
--docker-executable="${docker_executable}" \
--docker-socket="${docker_socket}" \
--profile=edge
node scripts/ql3-local-compose-rollout-live-contract.cjs \
--image="${IMAGE}@${DIGEST}" \
--docker-executable="${docker_executable}" \
--docker-socket="${docker_socket}" \
--profile=standalone
- name: Verify the keyless signature identity
env:
IMAGE: ${{ steps.identity.outputs.image }}
DIGEST: ${{ steps.push.outputs.digest }}
run: |
set -euo pipefail
certificate_identity="https://github.com/${GITHUB_REPOSITORY}/.github/workflows/ql3-image-release.yml@${GITHUB_REF}"
cosign verify \
--certificate-identity "${certificate_identity}" \
--certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
"${IMAGE}@${DIGEST}"
- name: Verify GitHub SLSA provenance from the published OCI registry
env:
GH_TOKEN: ${{ github.token }}
IMAGE: ${{ steps.identity.outputs.image }}
DIGEST: ${{ steps.push.outputs.digest }}
run: |
set -euo pipefail
gh attestation verify "oci://${IMAGE}@${DIGEST}" \
--repo "${GITHUB_REPOSITORY}" \
--signer-workflow "${GITHUB_REPOSITORY}/.github/workflows/ql3-image-release.yml" \
--source-digest "${GITHUB_SHA}" \
--source-ref "${GITHUB_REF}" \
--deny-self-hosted-runners \
--bundle-from-oci
- name: Verify the reviewed CycloneDX attestation from the OCI registry
env:
GH_TOKEN: ${{ github.token }}
IMAGE: ${{ steps.identity.outputs.image }}
DIGEST: ${{ steps.push.outputs.digest }}
run: |
set -euo pipefail
gh attestation verify "oci://${IMAGE}@${DIGEST}" \
--repo "${GITHUB_REPOSITORY}" \
--signer-workflow "${GITHUB_REPOSITORY}/.github/workflows/ql3-image-release.yml" \
--source-digest "${GITHUB_SHA}" \
--source-ref "${GITHUB_REF}" \
--predicate-type "https://cyclonedx.org/bom" \
--deny-self-hosted-runners \
--bundle-from-oci
- name: Verify the OS vulnerability evidence from the OCI registry
env:
GH_TOKEN: ${{ github.token }}
IMAGE: ${{ steps.identity.outputs.image }}
DIGEST: ${{ steps.push.outputs.digest }}
run: |
set -euo pipefail
gh attestation verify "oci://${IMAGE}@${DIGEST}" \
--repo "${GITHUB_REPOSITORY}" \
--signer-workflow "${GITHUB_REPOSITORY}/.github/workflows/ql3-image-release.yml" \
--source-digest "${GITHUB_SHA}" \
--source-ref "${GITHUB_REF}" \
--predicate-type "https://qinglong.dev/attestations/image-os-vulnerability/v1" \
--deny-self-hosted-runners \
--bundle-from-oci
- name: Promote only the verified digest to immutable release tags
env:
IMAGE: ${{ steps.identity.outputs.image }}
VERSION: ${{ steps.identity.outputs.version }}
DIGEST: ${{ steps.push.outputs.digest }}
REGCTL: ${{ runner.temp }}/regctl
run: |
set -euo pipefail
"${REGCTL}" image copy "${IMAGE}@${DIGEST}" "${IMAGE}:${VERSION}"
"${REGCTL}" image copy "${IMAGE}@${DIGEST}" "${IMAGE}:sha-${GITHUB_SHA}"
if [[ "$("${REGCTL}" image digest "${IMAGE}:${VERSION}")" != "${DIGEST}" ]]; then
echo "release version tag does not resolve to the verified digest" >&2
exit 1
fi
if [[ "$("${REGCTL}" image digest "${IMAGE}:sha-${GITHUB_SHA}")" != "${DIGEST}" ]]; then
echo "release source tag does not resolve to the verified digest" >&2
exit 1
fi
Reference in New Issue View Git Blame Copy Permalink